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Abstract. Device independent quantum key distribution aims to provide a higher 
degree of security than traditional QKD schemes by reducing the number of 
assumptions that need to be made about the physical devices used. The previous 
proof of security by Pironio et al. applies only to collective attacks where the state 
is identical and independent and the measurement devices operate identically for each 
trial in the protocol. We extend this result to a more general class of attacks where 
the state is arbitrary and the measurement devices have no memory. We accomplish 
this by a reduction of arbitrary adversary strategies to qubit strategies and a proof 
of security for qubit strategies based on the previous proof by Pironio et al. and 
techniques adapted from Renner. 



1. Introduction 

Traditional quantum key distribution protocols rely on a model of the physical devices 
being used which involves a number of assumptions, such as the dimension of the Hilbert 
space, the measurement performed, uniform behaviour of detectors, etc.. The actual 
devices used may deviate from the model and an in-depth knowledge of the system 
in question is necessary to decide if the assumptions are valid, or the extent to which 
they are invalid. If the assumptions are not satisfied, then there exists the possibility 
of information leaking to the adversary. Device independent quantum key distribution 
aims to reduce the number of security assumptions that need to be made in order to 
obtain a provably secure key from a quantum key distribution protocol. 

Device independent quantum key distribution (DIQKD) aims to replace the model 
of the physical devices with physically testable or enforceable assumptions. In particular, 
the protocols test the extent to which the physical devices can violate a Bell inequality 
and use this to bound the amount of information leaking to the adversary. Device 
independence refers to the fact that no knowledge of the internal mechanism of the 
devices is necessary, and in fact the devices may be provided by the adversary. The 
participants in the protocol only need to observe sufficient violation of a Bell inequality 
to prove security of the protocol. 

Rather than starting from traditional quantum key distribution protocols, DIQKD 
builds on protocols based on causality constraints. Work on these protocols began with 
|BHK05] . and an efficient protocol was introduced in [AMPOGj . The security proofs 
for these protocols were generalized to the scenario of global attacks by non-signalling 
adversaries in [MRW^OGj and |Mas08j . These protocols were first considered in the 
context of quantum adversaries in |ABG"'"07j with a rigourous proof of security against 
collective attacks appearing in |PAB+09j . 

The DIQKD protocols considered to date rely on Bell tests to quantify security. 
Currently, assumptions need to be made in order to perform a Bell test and derive a 
security bound. Previous proofs applied only to collective attacks, which assume that 
the devices can be used repeatedly and the different trials are all independent and 
identical. The current work aims to weaken the assumptions by allowing the trials to 
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be different and correlated. The remaining restriction is that there is no memory from 
one trial to the next. 

1.1. The protocol 

The protocol that we use was originally described in [AMPOGj and shown to be secure 
against collective quantum attacks in |ABG"'"07] and |PAB"'"09] . Two parties, Alice 
and Bob, share a small amount of secret key and wish to expand this into a larger 
key. They have access to an uncharacterized device which emits bipartite states, 
connected by quantum channels to a pair of uncharacterized measurement devices. 
Alice's measurement device has three settings, while Bob's has two. Finally, they have 
access to a insecure classical channel. They use some secret key to authenticate data 
sent on the classical channel. 

(i) Before beginning, Alice randomly chooses a list of m trials to be used for parameter 
estimation which she sends to Bob encrypted, using some private key bits. 

(ii) For each trial, Alice and Bob request a state from the source. If the trial is to be 
used for parameter estimation, Alice and Bob choose their measurement settings 
uniformly at random from {0, 1}. Otherwise Alice chooses setting 2 and Bob chooses 
setting 0. 

(iii) After all trials are completed, Alice and Bob announce their measurement settings. 

(iv) Alice randomly flips each measurement outcome and announces whether or not she 
does so. Bob flips his outcomes whenever Alice does. 

(v) Alice and Bob publicly announce a permutation and reorder their trials according 
to this permutation. 

(vi) Alice and Bob estimate S (defined below) from the parameter estimation trials. 

(vii) Alice and Bob perform error correction on the remaining trials, correcting Alice's 
outcomes to correspond with Bob's, resulting in the raw key. 

(viii) Alice and Bob perform privacy amplification on the raw key according to the secure 
key rate predicted by S. 

The above protocol could be efficiently implemented using quantum apparatus by 
a source of qubit pairs in the state | 0+) = ^ | 00) + ^ I H), with Alice's measurements 
given by the operators X, y, and ■ Bob's measurement operators are and 

■ The security comes from the fact that in order to achieve a high value of S", the 
state that Alice and Bob measure must be close to | 0+) and hence Bob's measurements 
are uncorrelated with Eve. The efficiency of the protocol comes from the fact that 
Alice can align her measurement with Bob's a significant amount of the time and obtain 
strongly correlated results, so long as she chooses the other measurements often enough 
to detect any deviation in the state from | 

Instead of choosing which trials to use for parameter estimation in advance, Alice 
and Bob may choose their settings independently, saving some key. This introduces 
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trials which are unusable (when Alice chooses 2 and Bob chooses 1) and unless Bob 
chooses and 1 uniformly, there will be some parameter estimation settings that occur 
more than others. Conceptually it is easier to suppose that the parameter estimation 
trials are first chosen and then the settings chosen uniformly. 

In |ABG+n7j and |PAB+n9j the protocol requires that Alice and Bob symmetrize 
their data by randomly flipping their outcomes according to a random string which is 
publicly broadcast. This simplifies analysis by allowing constraints to be placed on the 
quantum state. However, the symmetrization procedure need not be done in practice 
since it does not change the amount of information leaked to an adversary; Eve may 
account for the symmetrization in her own analysis after observing the public random 
string. Here we will assume the symmetrization has been done. 

1.2. CHSH inequality 

The CHSH inequality, originally derived in |CHSH69] . is a Bell inequality utilizing 
two measurement settings and two measurement outcomes for two parties. The two 
parties, Alice and Bob, each randomly apply one of the two measurement operators to 
a bipartite state p and compare outcomes. The measurement operators are Aa and -B^, 
where a,b E {0,1} are the measurement settings for Alice and Bob, respectively. Aa 
and Bb are Hermitian operators with eigenvalues 1 and -1. The CHSH inequality may 
be expressed as 

S= Yl tr(A,®5,p)(-ir^<2 (1) 

a,fe=0,l 

for local classical strategies, with an upper bound of 2\/2 for quantum strategies. 
Equivalently, we may use uniformly distributed random variables a,h E {0, 1} for the 
measurement settings and random variables x,y E {0,1} for measurement outcomes, 
and derive the inequality 

p = P{x®y = ab) < 0.75 (2) 

for local classical strategies, with an upper bound of cos^ | ~ 0.85 for quantum 
strategies. We say that a trial is successful if x Q) y = ab. The values p and S are 
related by 

S = 8p-A (3) 

Both of these quantities will be useful in this paper. We will be interested in 
the maximum value of S" or j9 achievable by a state p, maximized over all possible 
measurements. We denote these values by Smax{p) and Pmaxip)- 

1.3. Security against collective attacks 

As described above, the protocol could be performed using the same devices over and 
over. Pironio et al. ( |PAB"'"09j ) originally considered security against collective attacks, 
which relies on the assumption that the devices operate identically each time, and have 
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no memory of the previous trials. For the source this means that state emitted over 
n trials has the form p®". A physical implementation using devices that are used 
repeatedly must meet the following assumptions 

• On each trial the source emits p 

• The combined state that the source emits is p®" 

• The measurement devices have no memory 

Pironio et al. showed that if Alice and Bob estimate the value of the CHSH operator 
to be S (settings and 1 for Alice), and they estimate their bit error rate to be q (setting 
2 for Alice), then they may extract a secret key at the asymptotic rate of 

1.4- Main result and overview of proof 

The main result in this paper is to show that the protocol described in |ABG"'"07] is 
secure with the same asymptotic key rate against a wider class of attacks. For our proof 
we suppose that all trials are performed on separate devices that do not communicate 
with one another. This may seem more restrictive, but in fact it is a relaxation since 
the states may be arbitrary rather than product states, and the devices do not have to 
operate identically. 

A physical implementation of this scheme with many devices is clearly impractical. 
A practical implementation with single devices used sequentially could be made, with 
only the following assumptior(j| : 

• The measurement devices have no memory 

The model that we use in the proof is that the state is divided into many parts, and each 
trial corresponds to a measurement that operates on only one part. By assuming the 
measurement device has no memory and using it sequentially (providing measurement 
settings and states one at a time, and receiving the outcome before the next state and 
setting are given) this condition is enforced. 

The source may emit any type of state, which may include a complete specification 
on how the measurement devices are to operate on a particular trial. There is no 
restriction on the dimension of the state or on the form of the measurement operators. 
Another important consideration is that there are no losses. That is to say, there is no 
provision for cases when no outcome is given. We may deal with this by assigning a 

X Of course, Alice and Bob's devices must not leak information back to Eve. Additionally, the 
measurement devices must not communicate with each other in order to ensure that measurement 
settings are not leaked. These conditions are met if we assume that Alice and Bob's labs do not leak 
information, which is a requirement for any scheme to remain secure. Additionally, Alice and Bob must 
have sources of randomness that are uncorrelated with Eve. Again, this is a basic requirement for any 
scheme. 
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random outcome, which simply adds to the noise, or by adding assumptions, such the 
adversary having no control over the losses once the measurement settings are given. 

The proof relies heavily on |Ren05] . chapter 6 and [PAB"'"09] . Two important 
contributions are made. The first is to deal with the unknown dimension of the state, 
since the finite de Finetti theorem used ( [Ren07] and [RenOSj ) is sensitive to dimension 
which in our case is unknown and unbounded. The second modification is in parameter 
estimation. The proof of security in |Ren05] assumes that the measurement operators 
are constant and known, while in our case neither of these is true. Finally, we adapt 
the security bounds of |PAB"'"09] to work within Renner's security proof, obtaining the 
final key rate. 

We will first prove security in the case where the states on each trial are restricted 
to a pair of qubits, which will fix the dimension and allow us to apply the finite de 
Finetti theorem. Later we prove that this is sufficient. 



2. Proof of security for qubit strategies 

In this section we restrict our attention to the case where the state source emits a 
pair of qubits and the devices each measure one of these qubits. Our proof of security is 
derived from the one given by Renner in [RenOSj . The main difference is in the parameter 
estimation. Central to the argument is the finite quantum de Finetti theorem published 
in |Renn7j . 

The first set of states that we will concern our self with are states in the symmetric 
subspace of Ti®^ along | which is the subspace spanned by states which are of the 

form I 0)®""'" ® I 0') for any | 0') on r subsystems, or any state obtained by permuting 
the subsystems of such a state. This subspace is important because the states in it 
are very close to symmetric product states, which are very nice to work with. We will 
denote it by Sym{'H, |0)®"'~^). The finite quantum de Finetti theorem allows us to 
break symmetric states into a mixture of these near-product states. 

Theorem 1 (Renner |Ren07j Theorem 4.3.2). Let p G 7^®"+'= be a pure, permutationally 
invariant state and let < r < n. There exists a measure v on the normalized pure 
states ofTi, and for each normalized pure state inTi a pure density operator on 
Sym(T-[, I 0)*^""^) such that 



1 

Here tr^ means tracing out any k subsystems. The general strategy for the security 
proof will be to use the fact that the 1-norm is non-increasing under quantum operations 
combined with the triangle inequality to finally put a bound on the distance between 
the key obtained by applying the protocol to p and the ideal key which is uniform and 
uncorrelated with Eve. 
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2.1. Parameter estimation 

At this point we need to develop techniques for estimating the CHSH value of states 
which are nearly symmetric product states in the sense introduced in the previous 
section. This is analogous to Theorem 4.5.2 in |Ren05] . However, in that case the 
measurement operations on each subsystem are all known and identical. In our case 
the measurements are not in our control, and we may have no description of them. 
Fortunately this is not a very important issue. The CHSH value that can be achieved 
by a particular state is a property of the state itself. If the measurements used are not 
optimal, then the observed CHSH value can only be lower than if the measurements 
are optimal. Since we are only interested in lower bounding the CHSH value, this is 
sufficient. Any CHSH value that we observe will (leaving statistical fluctuations aside) 
be a lower bound on the maximum CHSH value achievable by the state. 

Lemma 1 (Parameter estimation). Let \ G Sym{Ti.2 ® Ti.2,\4')'^^~^™'~^) let 
P = Pmax{ \ 0)) be the maximum expected value for success on the CHSH test on \(f)), 
optimized over all measurements. Let Y be the number of successes after conducting 
the CHSH test on the first m subsystems of \ ip) according to any measurement strategy. 
Then for fi > 

P {Y/m >p + ii)<exp "^(""^ ~ ""^^"^^^ +{n + m)h{^—) In 2 (6) 

[n — rjcos^TT/8 n + m 

The proof has two main steps. The first is to bound the given probability for states 
of the form | ^ \ <!>'), up to permutations of subsystems. Next we use a lemma 

of Renner that says | ip) can be expressed as a superposition of a small number of such 
states and use another lemma of Renner which bounds how much the probability can 
change for such superpositions. 

Proof. We now suppose our system is in the state | ^p') = \ 0)®™'"^® | </>') for some | (f)') on 
r subsystems. (We may also permute the subsystems without changing the argument.) 
Let Xj be the random variable corresponding to the success or failure of the CHSH test 
on the jth subsystem for the measurement strategy actually used (which may vary with 
j). Since the measurement strategy cannot do better than the optimal strategy, we have 
E{Xj) < p for 1 < j < m — r and E{Xj) < cos^ | for j > m — r. Applying Hoeffding's 
inequality ( |Wikj ) to the first m — r subsystems, we obtain for t > 1 

Pri^Xj>{m~r){p + t)]<e . (7) 

The remaining r subsystems cannot add very much if r is small. Thus 

Pr \ ^Xj> m{p + t)+r{l-p-t) < e~^°^^ . (8) 



where m{p + t) + r(l — p — t) = {m — r){p + t) + r and the additional r upperbounds 

m—r+l ' 



the value of Y.T=m-r+i 
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We now turn our attention back to | V')- Let z be an m-tuple with Zj = 1 if the 
jth trial is successful and Zj = if it is a failure. We may write the measurement 
operator for the CHSH tests together as one large projective measurement {M^} with 
Mz the projector corresponding to the outcomes of success and failure given according 
to z. Then the probability of getting the success/failure outcomes according to z is 
{ifj I Mz I Note that is positive semi-definite. 

We are only interested in the number of successful outcomes, which is given by 
w{z), the Hamming weight of z. We can restate the above result as 

-2(m-r)t^ 

I Mz I tfj') < e (9) 

'w(z)>m{p+t)+r{l—p~t) 

Now suppose that is in Sym{H,\ We can express as a 

superposition of states of the form | ^ | 0'^ to permutations of subsystems. 

We can apply the above argument to each of these terms in the superposition. We 
are only measuring m of the subsystems, so depending on the permutation anywhere 
between m — r and m of the subsystems may be in the state | (p) . Note that our bound 
still applies since the last r subsystems are arbitrary. The following two lemmas from 
|Ren05j bound how much error may be introduced by this procedure. 

Lemma 2 (Renner [RenOSj Lemma 4.5.1). Let \ ip) = Ylxex I ^"^^ P be a positive 
semi- definite operator, then 

{ij\P\ip) <\X\Y{x\P\x) (10) 

Lemma 3 (Renner |Ren05j Lemma 4.1.6). Let {ip) be a state in Sym{'H,\(j))®^~^) . 
Then there exist orthogonal vectors \ x) , which are permutations of \ 0)®""^ ® \ cp^) for 
X E X such that \ ip) is in the span of the \ x) for various x, and \X\ < 2"'^(^'/") where 
h{-) is the binary Shannon entropy. 

Applying these results we obtain 

— 2(m — r)t^ 

J2 {^\Mz\tp)<e ^°="f 2("+'^)'^(^). (11) 

w(z)>m{p+t)+r{l~p~t) 

Rewriting as a probability, we get 

— 2(m-r)t^ 

P{Y > m{p + t)+r{l-p-t)) < e -="f 2("+'")'^(^) (12) 
or, equivalently 

P (Y/m >p + fi)<exp /^ -2(m/x- r(l -p))^ ^ ^)/,(^_) 2^ (13) 

y [m — r)cos^TT/8 n + m J 

□ 
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2.2. Security 

Security for qubit strategies follows from the same proof as Theorem 6.5.1 in [RenOSj . 
with different parameters. Since the proof is laid out in great detail in |Ren05] we will 
only sketch the proof and indicate the necessary changes. 

We begin with a symmetric state n + m + k pairs of qubits, which we purify 
(according to Lemma 4.2.2 of |Ren05] ) on Eve's system to a pure symmetric state p. 
According to the finite quantum de Finetti theorem, we may drop k subsystems and 
obtain 

with G Symi^Hf^ .,\(f))®^^^~'^) and r depending on n,m,k,e according to table 
6.2 of |Ren05] . We next apply parameter estimation by measuring m systems with 
measurement settings chosen uniformly for Alice and Bob, and determine the number 
of CHSH successes, v. Then — is our estimate of p. If this estimate is below some 
threshold, pthres + {pthres is used to determine the key rate in the privacy amplification 
phase) we abort and map the state to 0. According to Lemma 1, if we choose p to be 




p = — \l ( — In — {n + m)h ^ — -j- — ^ ln2^ (m — r) cos^ — . (15) 

then the true value of p is lower than the estimate minus /i, only with probability less 
than |e. Thus we may apply the parameter estimation to obtain 



'V 



4 . s 



where we restrict the integral to the set of states | (j)) which have CHSH probability of 
success Pthres OT higher (denoted by V). The PE superscripts indicate the application 
of the parameter estimation protocol. 

We now have (if the protocol did not abort) a state p^^ which is nearly 
indistinguishable from a mixture of near-product states with CHSH success probability 
better than pthres- We may now characterize the smooth min entropy of this family of 
states and apply privacy amplification, deriving a security bound. A parameterization of 
the states appears in [PAB+09] . equations (28) through (31). However, the calculation 
is essentially the same as it appears in |Ren05j and is beyond the scope of this article. 
Instead, we will appeal to the final result and calculate the asymptotic key rate. 

In |Ren05j . Corollary 6.5.2 we find the asymptotic key rate after privacy 
amplification to be 

min HiX\E)-HiX\Y) (17) 

with H{X\E) and H{X\Y) evaluated for state cjab, and 5" = Spthres — 4, while X and 
Y are the classical outcomes for Alice and Bob upon measuring aAB- The system E is 
Eve's system, which we take to be a purification of ctab- Additionally, we must minimize 
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over measurement strategies of Bob's devices consistent with producing a CHSH value 
of S or better. 

We now evaluate the minimum above to obtain the key rate. First, Lemma 3 in 
[PAB"'"09] allows us to consider only Bell-diagonal states. Briefly, the argument relies 
on the fact that Alice and Bob symmetrize their marginals, together with a suitable 
local change of basis placing Alice and Bob's measurements on the X, Z plane of the 
Bloch sphere. The state gab can thus be characterized by its eigenvalues, which 
are the diagonal elements in the Bell basis. We denote these values by the tuple 
A = (A$^, A<i,_, A$_, A^^), with the subscript denoting the Bell basis element. Lemma 4 
m |PAB+09j gives us the bound 

MA) - MA*, + A,_) < . {iivis^ssi:^' 

where h is the Shannon entropy. 

Recall that for state axE^ H{X\E) = H{axE) — H{aE)- The state has the 
same eigenvalues as aAB since as is the purification. The eigenvalues are given by A, so 
H{E) = h(X). 

In |PAB"'"09| the state axE may be calculated from equations (28) through (31) 
in the proof of Lemma 5. We sketch the calculation here. Alice and Bob share the 
Bell-diagonal state cjab and we give Eve the purification in system E giving a combined 
state of J2x I ® I ^a;)^' where x ranges over the Bell states. We trace out 
Alice's system and measure Bob's to obtain a classical system X in place of the system 
B. Bob's measurement can be parameterized on the Bloch sphere as cos(f)Z + sin0X. 
The resulting state axE is specified in equations (30) and (31) in [PAB"'"09] and equation 
(32) gives the eigenvalues to b^ 

A± = ^ ^1 ± (A^^ - X^_y + {\^_ - X^^y + 2 COS 20(A</,+ - X^_){\^_ - A^^ 

each with multiplicity 2. This gives H{axE) to be 1 + /i(A+), which is maximized for 
= where A+ = A^+ + A<^_ . We obtain 

H{X\E) = l + h{X^^ + X^_)~h(X). (20) 

The secret key rate is thus bounded below by 



i-'.(ii^f^)-M,) (21) 

where H{X\Y) = h{q) and q is the bit error rate between Alice and Bob's raw keys. This 
is the same asymptotic rate achieved in [ABG"'"07 . Note that there is no relationship 



between 5* and q, since Alice's raw key comes from an unknown measurement. Her 
measurement may measure p or some other system. In all cases it is possible for q to 
range from to 1, regardless of the value of S. 



The states and eigenvalues in jPAB+09 are actually for Eve's system conditioned on Bob's 



measurement outcome, but it is an easy matter to adapt them for our use. 
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3. Security for arbitrary strategies 

3.1. Block diagonalization of measurement operators 

The following lemma is originally due to Jordan | Jor75j . but has been rediscovered many 
times. Modern proofs appear in |Masn6] and [PAB+OQ] . We will use the formulation 
appearmg m |PAB+09j . 

Lemma 4 (Pironio et al. |PAB"'"09] Lemma 2). Let and he two Hermition 
operators on Ti with eigenvalues 1 and -1. Then A^ and A} can he simultaneously hlock 
diagonalized with hlock sizes 2x2 and 1x1. 

Corollary 1. Let A^ and A^ he two Hermition operators on Ti with dimension 2n or 
2n — 1 and eigenvalues 1 and -1, then there exists an isometry F from Ti to 7i„ ® Ti.2 
and Hermition operators A^'^ on 7^2 with eigenvalues 1 and -1, such that 

F{A^) = J2 I I ® ^""'^ (22) 

z 

This corollary says that we can think of applying one of these two observables as 
first applying a projection to learn z. The value of z then simultaneously determines a 
measurement strategy for either measurement setting. Importantly, the projection onto 
z can be applied before learning the measurement setting. This will allow us to consider 
an arbitrary strategy as a probabilistic combination of qubit strategies. 

3.2. Reduction to quhit strategies 

Let A'j be the observable for Alice mesaurement on the jth trial with setting a, and 
analogously for Bob. We apply corollary [1] to pairs of observables A'j and A] (5° and 
Bj) to obtain isometry Fj (Gj), from the Hilbert space of the original state to Zj^ ® 7^2 
{Z^ (g) 7-^2) • The result is that we can map A°j^ (sf) to 

j2%®^r (23) 

with the Hi. commuting for different j, and analogously for B^'^^ with projectors n{,^. 

We have mapped a strategy of Eve to a strategy with state p on Hilbert space 
Z (g) {TCf")A ® (7if'")_B with measurement operators of the form above. Note that we 
may perform a projective measurement with projectors II-^^. for each j to determine 
all the Zj and analogously for Bob's side to determine the WjS before determining the 
measurement setting without changing anything, since these projectors commute with 
the measurements A'^ and S^. Eve loses nothing by performing this measurement herself, 
so we may assume that she does so and learns each zj and Wj. The result is equivalent 
to if Eve prepared a mixture of qubit strategies. We may further suppose that Eve holds 
the purification for each possible qubit strategy and only increase her power. 

We have reduced all possible strategies to a mixture of strategies on qubits. If Eve 
in fact performs such a mixture strategy, then for each qubit strategy in the mixture, 
either the key is secure, or the protocol aborts with high probability. 
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4. Open problems 

There are two main open problems left for this protocol of device independent QKD 
see |PAB+09j for some others). The first is to remove the restriction that the devices 
have no memory. As discussed in |PAB"'"09 the devices may be restricted to classical 



memory since any quantum memory could instead be teleported forward using extra 
EPR pairs in the state and classical memory. 

The second open problem is to find an effective means of dealing with channel 
losses and inefficient detectors. The detector efficiency loophole quickly translates 
channel losses and detector inefficiency into low key rates if they are treated as noise. 
This severely limits the practicality of the current DIQKD schemes with the present 
technology. See [FAB"*" 09] for an in-depth discussion. 
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